SteamHide Malware Hides in Steam Account Profile Pictures

SteamHide Malware Hides in Steam Account Profile Pictures

G Data analysts Found Malicious SteamHide whose operators hide malware in the metadata of images in Steam profiles.

For the first time, strange pictures on Steam were discovered by cybersecurity researcher Miltinhoc, who talked about his find on Twitter at the end of May 2021.

Researchers at G Data say that at first glance, such pictures are harmless. Standard EXIF ​​tools do not detect anything suspicious in them, except that they warn that the data length in the ICC profile is incorrect.

However, in reality, instead of an ICC profile (which is usually used to display colors on external devices, such as printers), such images contain encrypted malware (inside the PropertyTagICCProfile value).

In general, hiding malware in image metadata is not a new phenomenon at all, the researchers admit. However, using a large gaming platform such as Steam to host malicious images complicates matters significantly. Attackers have the ability to replace malware at any time, just as easily as changing a profile picture file.

At the same time, Steam simply serves as a tool for hackers and is used to host malware. All the bulk of the work involved in downloading, unpacking, and executing such a payload is done by an external component that accesses the Steam profile image. This payload can also be distributed in the usual way, in emails or through hacked sites.

The experts emphasize that the images from Steam profiles themselves are neither “infectious” nor executable. They are only a means to carry the actual malware, which requires a second malware to extract.

SteamHide Malware Hides in Steam Account Profile Pictures

The second malware in question was found by researchers at VirusTotal and is a downloader. It has a hard-coded password “{PjlD bzxS #; 8 @ x.3JT & <4 ^ MsTqE0 “and uses TripleDES to decrypt payloads from pictures.

On the victim’s system, the SteamHide malware first requests Win32_DiskDrive for VMWare and VBox and exits if they exist. The malware then checks to see if it has administrator rights and tries to elevate privileges using cmstp.exe.

On first launch, it copies itself to the LOCALAPPDATA folder using the name and extension specified in the configuration. SteamHide is pinned to the system by creating the following key in the registry: Software Microsoft Windows CurrentVersion Run BroMal

The IP address of the managing server SteamHides is stored on Pastebin, and can be updated through a specific Steam profile. Like the loader, it extracts the executable from PropertyTagICCProfile. Moreover, the configuration allows him to change the ID of the image properties and the search string, that is, in the future, other image parameters can be used to hide malware on Steam.

While SteamHide does not have any other functionality and it looks like the malware is still in development: researchers have found several code segments that are not currently in use. For example, the malware checks if Teams is installed by checking for the presence of SquirrelTemp SquirrelSetup.log, but after that no one happens to this information. Perhaps this is necessary to check installed applications on the infected system so that they can be attacked later.

Also, experts have discovered the ChangeHash () stub, and it looks like the malware developer is planning to add polymorphism to future versions. The malware can also send requests to Twitter, which in the future can be used to receive commands via Twitter, or the malware can act as a Twitter bot.


ProApk on Google News
ProApk on Telegram
ProApk on Twitter
ProApk on Facebook